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(57)Abstract: 

PROBLEM TO BE SOLVED: To provide a network-monitoring 
method and a network-monitoring system which can monitor the 
state of application of a network, detect unauthorized access in a 
network or its apprehension, and inform abnormality to a system 
manager on real time, and storage medium recording its program. 
SOLUTION: User' events to a network are collected as log data. 
From the collected log data, a profile showing the state of ordinary 
application of the network is formed for each user. Newly collected 
log data are compared with the profile for each user. By displaying 
compared results of the newly collected log data, the state of 
application of the network can be monitored from the compared 
results of the newly collected log data which are displayed. Thereby 
the unauthorized access in the network or its apprehension can be 
detected, and the abnormality can be informed on real time. 
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SlCfiS-g-L, 

t i -f 3 * y h V - ? SIS*)*. 

WEHf/c(C)t2« Lfc n ^x-* roM-g-^ICiS LTffrlE 
p i/x-^ (O^^ffi^M^ ^*T*^-f 5 ^ t 

[f»*93] *y IV-tK-ft-fZ,*.— fc^'O'h 

striex - £ ^ t ^ 5 p ^x - b ^ - 

5:4jjct57'a77^^?St, 20 
SfIIEJ|X«^T-fffclwJ{K* Lfc d SrlttJfET'p 7 

ffirlEtf/clcUKft L/cn ^r-* rofi?.^m?r**-r5^ 

[lf#94] «#«3f5*tf>*y yv—tm.Ws^'r 
HfTfES^im, HtrlEff/cJciR^Lfca^-^^^^- 

i^sm LTSfrisn i/r-^ (ommmmzmte z - 

t^mt-rS^y hy-^HtS^^xA,, 30 
[§jf#*5] W#93£fcli4fS«t<0*y h?-*!! 

hy-^gtlv-^x^o 40 

*y h^-^^^-f-^^—tf^^V h-grP^x-* t 
LTJfc A Ltf- * x-* ict^f 5HX«#tt, 

5 7° p 7 r -f t , 

r ^ /u t f mm-s-r % m&^& t , 
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[0 0 0 1] 

[»W©jW5a«#l!F] *mW\t. *y M7-^K« 

yM7-?E«*ft, *y H7-^B»V^^^aw-t 
W7'n^9ASr|BSLfclE»«E«^Bii-5. 
[0 0 0 2] 

[&*©&«] tt*±9» *y M7-**fcHt*y M7 
«-*©*M»ISlo:#U H7-^©*MBS*fcttrt» 

fflJ®t*ot*J9, -*y M7-^jEffiA£fc*m?t3 
^^^xAOSSiSMiixTV^o ±IE©*y M7- 

©*Wfl«tl»ttT?#*V^< bV%#V\ £©fc»t>, «A 

[0 00 3] t) , m$r j $>m&%m*mm lt 

i. *) ^S$&£fl (anomaly detection) 

L, ^e-^y ^i/-f-5tv^5 t©-C-fe5. 
[0 0 0 4] Sfc, 3.— tfOn-rV Ko^tiStLT^ 

gK«fc 19 p-^>- KD^O->-^>^S:^tfft-5©F^^i' 

[0 0 0 5] 

[flM^gtLi^fc-rSKH] L^L, K#»«f9£« 
mmtiWm-Z-ih ^ y h ^fA^I7 
^■fe^asiTi3*j,fc«|»Tf, ^y M7-^Jp]E«A«:*» 
LT*y H7-^ffa«HIMr«r*P 

[0 0 0 6] ±SE©^t«**$^fcfc© 
■C, ^y H7-^«ffl*a«rftaLT*y h!7-^^FiE 

[0 0 0 7] 

^tLTHX^L, iR^SJtfcn^x-^^Pja- 
autoes' h 7-^«l«»^t7 , n 7 7^f ;L-?r« 
L, SrfcfdHX^L/cD^-^SrgfJlS^n^T-Y^i:^- 
— fSlc^L, WI5frfc^HX*Lfcny^-^©^ 
*S*ilr«^-t-5r irtcj;^, *^$tt5fffc(CJR*Lfc 
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4iim, 3T^ff A-KJ|#trfti6)*»w4:3S*"C 

[0008] 2 \zum<o%m*. i taito 

So 10 

[0 0 0 9] »*«3(CfEtt^^{i, ^yh!7-^K 

[0 0 10] M**4|cette>XHtt* W#«3f2«© 
T^?** -Mem?*, *y M7— ^^EftAirbTtt 

So 

[00 11] ft*«5{'|E«cCD||^{4. »#«3*fctt 

^(Oit^fiJS CT 2 &5cttK*jjH-5 rtl^J: 9 „ *:* 
co n 9 <n±8l$:mmi- Sit # WfiB t <C S „ 
[0012] StsfciS 6 If 3 5 

£f$oi LP^T^TfllricSftSriK.k'K 40 

[00 1 3] tt#«7fcflEiW>»HW:» 

fc &fcifc L fc n i/^- * ^Sfj|S7°n 7 7 W * £ 
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^7- 7 M7-*«/B:Ra*efc"e 
5. 

[0 0 14] 

\%m<o%m<owm\ muz, *»«o*yH7-?fi 

fi-^f ****** its 3 >- tr»-* v^xacd-^JI 
0||o^o y^«*H«r^-f. I^E! 1 * 1 . CPUl0f4v-* 
T^^flwflJPfc^So CD (=1"** hxi'^^) ^ 
fil 2\C±y h£tlX&§L£tlZ>CD\aZ. CPU10 

S„ ^- K7* -f **Sfi 1 4 trty— y X V 7 v-f-fxi 

-^^-^iSfett^ilS. *7t, ROM1 6{C|4£*>± 

n 7*7 ^^tA7'p ^7 A£Sc^&tffciO©7°n / 
7*a s *&*ft£*tT^5. 

[0 0 15] RAMI 814, C P U 1 0 # HfT "TS^n 

o^RHW-i: UTffiffi^ns, jiff 2 oiiLAN^ 

W8f2 2f4x^^7°W^*S: : ffV\ 7°!Jy^24 
f^MSifeS^SrT'y >-hT"7 h-TSo ATJgf 2 

6 t Lta^^ K^SrATJ-fS^r— Kt, *^Siffi 

^K»te>*ttv^<5. ±co«-ttwntt^^7A/<x 2 8 
[0016] i2ii *mmv*y Yv-^m.Wy^'r 

-M-^3 2« 7*077^ y V^y^^S 4, S-tf 
f^T;V7*7!>f 3 6^?j*5. P^fiy*-3 0 

^yhSrn^f-^t LTi!xSLo^x-^"<-^ 3 2 
iCfejW-fSo v V"?—?^-* 3 2(-lt5?*$nfcn^7 :? 
-?li7 , C77'fy^^>'34. Xt/Jf^aTA- 

[0017] 7°D7rW y y^iyv/y3 4H 
•y i coa^©«S»V^*-t-7°n7r'1'A?r^1-So - 
©7'n7 7'1'AC0^(Cl4 > »Mi7'P^7 5^^ 

(ILP: Inductive Logic Prog 
ramming) £WB-fSo 7 7 4 * 

{4, B^xy*-3 0*3<tt^tf^=- 7^7171^3 6 

{cj^l^ti/So 
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[0 0 18] P^fayi- 3 0\*Z.<DZfn7 7 4 

10 0 19] br^3.T/U^7C1f 3 614, aff—fr^ 

f^aT/^7!>f3 6^Jffll,t'f'<y WD7 7 

[0 0 20] gWBjfctt. ^Eft-f^V Htt&-njWart 
St^CjE^-f^^h^jE^^^ hb LX$ 
%a-tZ>U£<07°a7 7 jju$:7 , u7 T J y yf^yiSy 
3 4 5. S^r-Mffa*!**:/ h!7 

(4, ■=■-— (who) . vi/>i6 (where) , A 
(what) , J-O }-5m (how) s 

>imnmm (when) &&fbtiz> Q ^tu*. b*n 

[0 0 2 1] ^a7/^7?f3 6»4. u 

®mmtm%*fsmb u ^fAfiti^Lt, « 

6 {4, TV*7*l«"f^«2 2fc N 0 311^0^7^ 

[ 0 0 2 2 ] 0 3 (4, o ^7 frlM**©— jOMl* 

3 2 b ^SrJfc#-r5gg<afc&&#£iBA-!- 
S. r COHflS^jT'te, fig rh i r a i s h i J #> 
O, fcxVZx r i m c t 4 5 1 J Otkmtkft&ffi&i-S 
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r&j coftfr<jK r i j *m^xwmfBt:mfrr&z.b 

[00 2 3] Ge tW74 3 fct, X** A^K 

4 2 K1EA J; 6 b V?-* 

-So CI ear*^y4 4tl x=¥* h7^-^ 

K4 2©^U7?ri/Tt5 0 Back^y45(iGe 
t#^y4 3 5r^ y ?/^i--5-OH(f(c*^LfcB;/7^- 

^SrB^*^g|J4 0^$*5- tSrJS^i- S= tr5 

T% 7^h7^f -7W K4 2 lC*|eA^ffi-CG e t # 
10 ^>-4 3Sri? I> yf-fZb, W&iT^rfv'^ 4 '**>i\> 

42, Ge t^>43, Clear^y44> Ba 
c ktf^^M 5 {4. B;/;/7(7^V?*/Ufc*tt-e&< Xb 
bTt?3.T7'<X/^7K 7'0 77'f^ 

[0 0 2 4] b^SS^FM 0ICJ4, 3 
2d»fe*»LfcD[*Oo^Srff*(tT*«**ii5. 
fe«ro»l*7^l-tt^-if*. jB 2 #9 h 
20 B3*7^^l4Hff LfcaTV KRl*t©9lft, ■ * 
ffi<Dm4%7J*\ziimfl,itnttb&rMi> i &7f:£ti : 5o 

o^*^»4 0t*^$tbTV>S^— "f^** 
— iF^** hsg^x^^ Y7J— A>h'4 2ld3t°— $ 

ICLT, •v-7^gmc«tSB^(Dy7!7v ? >' ; /Srpr|gi: 
[0 0 2 5] ir5T\ Di/fi^-SOiaot, 

-f'O- h*»4l/fti ktr^y A*g=s#lcii^-rSo 
^E^^-O-Kc^jtS-rSB^x-^Sr^Jxtf* 

[00 2 6] H 4 (4, 7"D^7 4 *<*fl*<D— MM&l&tF 

To mm*, ttJ£M5ovn;B f?-?&Mnr&mm 

40 (x7*;Phfit) b^« 
^4 0K5S^$HTV>53-— tfife-^*^ 

v^^m^-rso *fc, 5 e t-(4b y*- 

3 0 tWiiff *tT5fc*lcn^ ;c s'*-3 0© I PT 
[0 0 2 7] P^IC, 7'D77'f!l^^>'3 4© 
50 TfcV^fcRtffeft-O^S. J:E«)D/fsy*-8 0 
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- r-S^roJE^Ii, u/fi.y*-3 0^n77^!) 
V^^i?>-3 4£Se'v f a7A'7*7l71f 3 6 tteM&S 

T, El 1 J; o (-> a^fiy*-3 0 J f'7'cJ7 7 

^ y y^iyj;y3 4*5^^3.7/^7 "7-^*3 6 il^- 
<dc PUT»i#i-5»-g-lc«£»s/«cv\ 

[00 2 8] 15IJ, t'S^ 77^ X^/PCO— HJjg^J 

ft, !f£.&Tj^i/v£^&5S1±as*§l$ 

*fiUfc3vyK (n^-;?©^?^ K) ^3c^£ft 
[0 0 2 9] *f?RJ$6 0<D$>$:{C\ii\fr?&¥±;U<Dm7F 

(»— If RVvJ'V) RtmiW©* »fc»oTn ^f*- 
JR146 2 t LT**£*U *fc, tf RJ*6 OO^Ct 
[0 0 3 0] frfcfcn^-^asfc&ifcfclfrg-ij: 

fi, ft£r©?^X— ^£ffiRSfc6 0cD^;fcCD-t?/U6 0 a 

5 IC^-t"0dtt. 1«n^6 0ttt*O-fe/U6 0 a 
jXTV^n^T 1 — 9 d S J ^#^>tv^^n— /U^tvfc 

[0 0 3 1 ] 3E(^> *i:©n^f*-*©f T?. ^FaEftf 
[0 0 3 2] ^l(7)^x=ry Un - r u 1 e d 3T 

V Ktt, a— yjJS^gfcUff LftV^-ry KT-foSfc*, 

[0 0 3 3] ^©TJX^y (2, Danger 
■C*9JfC**1-5. w©#x=ry IdWc, ^yM7-7 

fll ■BSJx.fi su, finger, ftp, telne 
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t, rlogin, alias, configure, 

SfcfttcfiJffl $*t5 fc ©T*fc-5. 
[0 0 3 4] ^©^X^ytt, Safety K 

7?^ /n-s-g-r s = > K^mav ^ < =»'■*■ > 

K^roA^^yi^iil, 0fl*.lil s, cd, j la 
tex, j avaf©3vyKTJ)5 0 
10 [00 3 5] H4W*73'!)lt Unknown^vy 
K-e*>9*T?**1-5. r©*r=ry {4±f5^1~m3 

yfcv *y M7-^^FiE«A#tJ:oT^^ixfc = T 
[0 0 3 6] 7Cfi©n^X-^S:ll5C0ffiR^6 0 Id^ 
•5#, fto*«l4nr«|-eib5. LfctfoT, -hlE©J;5 

[0 0 3 7] 0iJx.fi, v^T^Wtli, SSS©Si^ 

[0 0 3 8] £*5, ^X^y ■KJSCTft«r*ftb*Set 
[0 0 3 9] H6H\ ^n7r>f^^^-*lifi«S: 

[0 0 4 0] gl 6 tc*-r09T*te, ^Iff^lS^ r 

h i r a i s h i J #3:— UCV*5o y 

Xh<Dm2ft(Dm?& T*, j a v a , J [£*5tt5 T*J 

r (7)^-— if^ Tj avaj t 5 =a^>' KSr-^S/VKH 
«*<5RJffl-t-5i:V^5^^-T?*>.5 0 Kft^ffl-*^^ 

5o ^5tTO|S34{i, if^-^v^V* Timet 

-r 03J T\ =»-^V K Tk t e r mj ^rUfirU, 
50 3lfco-#BK r&j "Srif^5i:V>5^-^ 
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[0 0 4 1] ^D7r^ U 4iaot4 
^Sc^gfl 7 0 T*I4, ^fTO/w-^SrSIilLfc*), &rfc& 

^ «©#|-C'I4 6 0 $>&IC$I#) SrS^-fS r t iAX 10 

[0042] ^vyr-f V^f^y^z 4X*\mtihWi 

IT-d^?^ (I LP) ^xASrfiJffl-t-5 0 IL 

^U-^-^tcg-^T^S,, IE»f!lE + , *.1t#|E 
" , ZtibZt&W-tZ'WmftiWiBZ^z-tztZ, (l) 
5£K«fc9iE»0iJ£^, (2) atit)AWJ«t 

%m&H*mmm^£.<9&r>rtz >0 20 

[0 0 4 3] 
[fcl] 

BAHtE' ■•••(1) 
B A H A E'b* 0 •■-•(2) 

ft<oWk ; r-7'\'*&-&irZ><Dt < gL\\ rixl4, 30 
LPv^x^StJ a v aWtftCio-C^-rSo 

[0044] rr-m, fam%.&znteo tt, Amt> 

!ft izfatfx&m$:&*Wftmt-r?>. :© 

v-^Wtfe Lfc rttuf ft h *v \ ZtomfefrfSx^- 

[0045] r r x\ # bntz/u- jufriE *m t AW 

*^©S^IEL<lffiM-C#?)^^-t-!fSg (Ac c u r 
a cy) , ItWSiJ-f-S^IlJ^iEWJ^t'WSSWSiJT* 
#5^Sr*1-^g (Sensitivity).,*^' 

I4 (Spec i f i c i ty) ©3fifflttffi^7>- 50 
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[oo46] ewje + tmrnnxiE t hxmwu-z T 

P (True Positive) iKRH-^tLt 
^JBrl"* F N (False Negative) i^b 
*5, **«E~ ^(SlftHT-jEt (F 
alse Positive) ififftHtAt LtW 
-f 5TN (True Negative) itf»e>#5£ 

[0 0 4 7] gI=TP/E + 
«=TN/E" 

»S= (TP + TN) / (E + +E" ) 

fflS*n*4»ofc« 9 0>tttB'<? * t L 

9-*Sr*t<i-5 4:lB*H:J:.<*n»ftH«<-4-5« 

[0 0 4 8] HI 7 14, 7 , D7r'(!)>'^>'v'y3 4rt 

© I L P^^AasHfri-^^y— ^SSiSSS^a©- 

[0 0 4 9] HE"?, •77'SlOtv'^fAfIf 
li**fcLfcvM4«B'<7 fBtt*#i: LT 

«9 2oOttt/<?^-m4*8. ^f77S12 

SLfcV^^tt, ^Ty7*S 1 4\zmt 0 rrx-li^a 

[0 0 5 0] ^xyT'S 16tl LP-^-r^li 

■ttdtefc^W L, -tftSrx* h LT 3 o<Offifi6^7 
-*&#£>5„ ^LT, ^f?7"S 1 St-^fAfl 

■CV^*»if5*»S:5W8-f"5. rrT\ JiJSL-T^Sifra- 
(4, ^fy7S 2 0OHtt7 P D-fe^|c:^-e, ft*fcL 

Lt^fj'7'S 1 2(CjS^Xs/7°S 12~S18|ri 

[0 0 5 1]-*, ■Ky-yZTS 1 

AsX'MMkLit^&m^?*-? o 

7-$SrIlfLt^fy7'S 1 2{Cii^xy7°S 1 2 
~S 1 8Sr»»iSi". *7C^LfcV>tt^7^ 

[0 0 5 2] ±IEO®S{C < toT, n^-r-:?^-* 3 

[0 0 5 3] u s e r_A (X) :-login 
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(X, " imctX' ' , Y) , type (Y, 1 ' 

1 p t, p imc 3, 3' ' ) . 

- 0X0— Mis h^imct X-Ctf^— ifAtf^y 
m^*vVy~?-7V^*$;m%.-r%V> imc 3£ffll^ 

[0 0 5 4] n^f-^"<-^3 2ftt, 7 7 << t SB 
fit*-* t *mm Lta ?t - * <7><ff SI£tT 5 o 

W^x-^-^tftfRtf, riD (g£SiJ#^§-) , io 
tf) , .^/JWc^yK (3l«Sr-t*35cv>) , 
v>K (§|*Sr-^tf) , a-r^Kfllfcj ;vhO 

/WiL-T, -^WplCCSV (Comma Separa 
ted V a 1 u e) J^SC^IHga^x-^^-^il^ 

[00 5 5] CWipfC. 7 7-4Vl'i§l«7 f -*'<— * 20 
4: JB V ^ 5 <D tf , M#,7 - * * mm "C # *V 

[0 0 5 6] M#x-^-<-^, 7r-f^*t> M«t* 
—9-r<— xZfcWf&tzZxDSmX'hZSQL (Stu 
ractured Query Language) 

08^:^-4. tf 7/1^7*7 71f 3 6<Du^yy 

frf'^K •7v;<7-4'<*/\'s \f\Sa.Ty<< 30 

7-*^-* 3 2^p>K#-r5tt ic, r^zn 
*PXRtfttjtf«rfTV\ ^<7?«»^*^#T, ±E©#/< 
tf, 7o 7 7^/^Mt5i©M#ttttl J ?fita©fit 

3 2 LT n i/^-^-^-^ 3 2 Srfljffl-f- 

5 0 B^f*y*-3 0tt, 4MRSi«>n^iKai«:fT* 
Oo ^<om^. D^fiy*-30ll, I2l9(c^-rj;5 40 
fc, n^lR^f— y<8 0 h8 
2a-8 2xtH45. *f«iLfcV^^ (»— 7*£ 

h£) !iJft*ixtf, S**Oo^4rfiai-5*=^ 

[0 0 5 7] n ^"(DlR^T'tf , ^ K 8 

2 a~8 2 xtfSlR&Lfcn^Srn^JfcSI-T— ^8 0/4^ 
^Jx.tfTCP/1 PSHRSTfUfflLTn^-^^-^a 

2 7 7 -OK 4fctf, M^M^x-^-^-^f-'tt 50 
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= ?i-^syh82a~82xft 1 -/xiyrJ V 

3i > >- 3 4 T?fftE£ $ tltc 7 a y 7 -f fV t # ?> ftfc n ^ 

ft tf $?» 7VU7*7 t-f 3 6 Ctti(ei-5. 
[0 0 5 8] 121 Otf, xi 3 O^^frfS 

1-5. ftlc, X7y7 , S 3 Z^iLfcnyf-^Srn 
>f=f—5"<-* 3 2{Cj^ft-T-5o ^7^7S 3 4t« 
#LfcD^x-^5r7°n7 7-l' y l^^Vv^S 4^b 
^$^TV>5MJE&-f57'n77^/V'i:fig^U-C, m% 
tiv?1)*gfrZm\\1rZ>o rr-e, JMfi*|»J£;h,ifc 
Xry7S3 6f ^Sfta ; /x-*£t*v^7,'l-'7 , 7!7 
If 3 6Ki§ff U^fy7"S 3 Olcif^, A##fcv>£ 
*JSiJ$tt5t-?r<0**^-7S'7'S 3 OfciSA/t?, -hlE© 

[0059] Ull 14, n ^f—f^— X 3 2 ^Hff-f- 

XS'T'S 4 Ot-n^fiy^-3 O^^jUfi^ilfen^ 
x-^SrgffU ^^i/7°S 4 2T*rcoai/x-^Sr» 
^-f-^o ^7^7'S4 4f7 , B77'f!)V7 , xy 

^Sl#S*>i 5 fcofc#-g-tf^7?'7 0 S4 6Tn^s5#f 
*^feofcn^-^^7°n7 7-r y 3 4 

(Cgf@L.-t*7 L s>:7-S4 8tittf. D^if*^/^. 
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